Two-Step Verification: The 10-Minute Setup That Blocks Most Account Hacks
A password alone is not enough. Learn what two-step verification is, which type to choose, and exactly how to turn it on for your email and social media.
If someone steals your password, they can walk straight into your account. Two-step verification (also called 2FA or multi-factor authentication) adds a second lock. Even with your password, the attacker is stopped.
What it means
You prove who you are in two different ways, from these three types:
- Something you know: a password or PIN.
- Something you have: your phone, a security key, or a code app.
- Something you are: a fingerprint or face.
Which kind is best?
Not all second steps are equal. From weakest to strongest:
SMS codes
Better than nothing, but text messages can be intercepted or your number can be taken over through a SIM swap.
Authenticator app codes
An app such as Google Authenticator, Microsoft Authenticator, or Aegis makes a new six-digit code every 30 seconds. Safer than SMS.
Security keys and passkeys
A physical key or a passkey on your device. These cannot be tricked by fake websites, so they are the strongest choice.
How to turn it on, step by step
Start with your email
Your email account resets all your other passwords, so protect it first.
Open security settings
Look for "Two-step verification", "2FA", or "Security" in your account settings.
Choose an authenticator app
Scan the QR code the website shows with your authenticator app.
Confirm with the code
Type the six-digit code from the app to finish setup.
Save your backup codes
The service will give you a set of one-time codes. Print them or store them offline. They help you get in if you lose your phone.
Repeat for important accounts
Banking, social media, cloud storage, and shopping accounts.
Staying safe with codes
- Never tell anyone your code, even if they say they are from the bank or the platform. Real staff never ask for it.
- Be wary of "approve this sign-in" prompts you did not start. Deny them and change your password.
- Update your phone number or app if you change devices, so you do not lock yourself out.
What most people miss
- Move your authenticator app carefully when you change phones. Many apps can transfer or back up codes, but you must set that up before you lose the old phone.
- Two-step verification stops most automated attacks, which is why security agencies recommend it so strongly.
